devsecopslisted

# DevSecOps — Secure Pipeline Integration ## Activate When - User invokes `/godmode:devsecops` - User says "secure pipeline", "add SAST", "security scanning", "shift left" - User says "container scan", "dependency scan", "secret scanning in CI" - User says "security gate", "block deploys on vulnerabilities" - Building CI/CD pipelines that handle sensitive code or data - After `/godmode:pentest` reveals issues to catch automatically - When `/godmode:cicd` needs security controls integrated - Compliance requires automated security testing (SOC2, PCI-DSS, HIPAA) ## Workflow ### Step 1: Pipeline Security Assessment Evaluate the current CI/CD pipeline security posture: ``` PIPELINE SECURITY ASSESSMENT: CI/CD Platform: <GitHub Actions | GitLab CI | Jenkins | CircleCI | Azure DevOps | Bitbucket> Source control: <GitHub | GitLab | Bitbucket | Azure Repos> Artifact registry: <Docker Hub | ECR | GCR | ACR | GHCR> Deployment target: <K8s | ECS | Lambda | VMs | PaaS> CURRENT SECURITY CONTROLS: ┌────────────────────┬──────────┬───────────────────────┐ | | Control | Status | Tool | | ├────────────────────┼──────────┼───────────────────────┤ | | SAST | YES/NO | <tool or none> | | | | DAST | YES/NO | <tool or none> | | ... ``` ### Step 2: SAST Integration (Static Application Security Testing) Configure static code analysis for security vulnerabilities. All security workflows share a common trigger (adjust per org policy): ```yaml # Common trigger pattern for all